Azure B2C securing metadata endpoint.

Question

Does Azure B2C support custom policy metadata endpoint security using either basic authorization or certificate? The below does not appear to work as no certificate was sent to the API. I could not locate any documentation indicating that securing for metadata is supported however, I was able to locate documentation indication that RESTAPI security is supported.

Answer 1

@Osibote, Olamipo I checked on this but there is no way to secure metadata endpoints by using basic or certificate based authentication. You may consider storing the metadata to a different location like Azure Storage blob and provide private access for example.

-----------------------------------------------------------------------------------------------------------

Please "mark as answer" or "vote as helpful" wherever the information provided helps you to help others in the community.

Answer 2

Depending on your scenario you can skip exposing metadata endpoints if it is to be consumed by B2C. For instance Apple doesn't provide an openid-configuration endpoint so one can hardcode it instead in the custom policy:
https://appleid.apple.com/auth/authorize
https://appleid.apple.com/auth/token
https://appleid.apple.com/auth/keys
https://appleid.apple.com

For the metadata endpoints exposed by B2C it's different - those you cannot lock down. It is however not considered a threat to have it exposed. (If so MSFT wouldn't expose the AAD Common metadata endpoint.) One would also assume MSFT has anti-DDOS mechanisms in place for core Azure services.